Deepfake Video Detection Tools Miss the $108M Italian Bank Scam

Imagine a message pops up on your phone from your boss. It's short, a little rushed, and asks for a favor that has to happen today. You trust your boss, so you start to act. Deepfake video detection (software that tries to spot fake or AI-made video) would never have flagged it, because there's no video at all.

That is roughly how an Italian bank reportedly lost about $108 million. No hacker broke in. Someone just played a person the right people would obey.

Deepfake video detection can't protect you from a fake that arrives as a message or a phone call, so the safest habit is to check any urgent money request through a second channel you already trust.

Why Deepfake Video Detection Misses the Scam That Cost an Italian Bank $108M

Most of us picture deepfakes as synthetic video: a celebrity saying something they never said, or a politician caught in a clip that never happened. That picture is why so much of the conversation is about deepfake detection, meaning deepfake detection tools that scan footage for telltale glitches in images and motion.

This case didn't need a video. According to Biometric Update, the scheme started with a WhatsApp message that claimed to come from the bank's CEO. Then came a phone call in which an AI-cloned voice played a senior lawyer. Two familiar names, two channels, one very expensive mistake.

Italian bank loses $108M to AI messaging fraud, as identifAI warns of deepfake threat This article is part of a series, start with Deepfake Voice Scam News Today 77 Of Targets Lost Money.

Headline of the original report, Biometric Update

Visual deepfake detection versus a fake that never appears on screen

Here's the gap. If you build your defenses to detect deepfake video, you are guarding the front door while the scammer walks in through a chat window. A text message has no flickering eyes or odd lip movement to catch. A cloned voice on a phone call has no frame to freeze.

So the question changes. It stops being "does this look fake?" and becomes "should I trust this request just because it claims to be from them?"

---

Italian Bank AI Fraud: How a Message and a Cloned Voice Moved the Money

Let's slow the Italian bank AI fraud down, because the order of events is the whole trick. The researchers who tracked the case describe a chain. First the WhatsApp message, supposedly from the CEO. Then a call with a cloned voice of a senior lawyer, backing up the request. Each step made the next one feel safer.

Nobody had to crack a password. The people who could approve the payments were simply persuaded. As the reporting on the case puts it, the money then moved overseas. Authorities recovered about €53 million, per Complete AI Training, but a substantial sum is still unaccounted for, converted into cryptocurrency. Recovery, in other words, is partial at best.

Why does a familiar name feel like proof?

Psychologists call it authority bias: we tend to obey someone who seems to be in charge, often without thinking. A CEO's name does that. So does a lawyer's calm voice. Scammers don't need to be clever about your computer. They only need to be convincing about who is asking.

And the second contact is the real weapon. One odd message might make you pause. A follow-up call from a second "official" feels like confirmation. It's actually the same scammer, wearing a second mask.

Read that number twice. This isn't a scam most people spot and shrug off. When the voice gets through, most people pay. The same research says a usable voice clone can now be built from about three seconds of audio. Think of a conference talk, a LinkedIn clip, or a voicemail greeting.

---

Can Deepfake Detection Tools Stop Voice and Message Fakes?

No, not by itself. Deepfake video detection only looks at video, and this fraud used a text message and a phone call. Deepfake detection tools can help with deepfake videos and fake footage, but a payment scam needs a different safeguard: a rule that forces a second, independent check before money moves. Previously in this series: Immigration Biometrics 30 000 Officials Can Search Prints.

That sounds small, but it is the part that works. The Arup case in 2024 showed the same pattern with a fake video call that cost one company about $25 million. Even real-time deepfake detection on that call would only have examined what appeared on screen. Whether the fake arrives as a face, a voice, or a chat, the defense that holds up is the same. Don't let one channel be enough.

Old habit	What the Italian bank case shows
Trust a call because the voice sounds right	A cloned voice can sound right, so voice alone is not proof
Rely on deepfake video detection to catch fakes	A fake can arrive as a message, with no video to scan
Treat a second contact as confirmation	A second contact from the same scammer is just more pressure
Act fast when an executive asks	Urgency from an authority figure is the trigger to slow down

---

What Helps Beyond Deepfake Video Detection Before You Send Money

Here's the fair counterpoint, and it's good news. This is not an unsolvable problem. The defenses security teams recommend are almost boring. According to BrightSide AI, controls such as rotating code words for verbal requests, mandatory time delays on unusual transfers, and written out-of-band confirmation (checking through a different channel than the one that asked) still work.

How to detect deepfakes and fakes that aren't video

You don't need to be an expert to borrow the idea. If you ever wonder whether a photo, a profile, or a message is really from who it claims, that is the exact question this kind of verification technology exists to answer. For everyday life, one simple move does most of the job: hang up and call back on a number you already had saved. Not the number in the message. Not a number someone reads out to you. Yours.

A few more habits that cost nothing:

• Agree on a family code word. A cloned voice can't guess a word you picked at the kitchen table.
• Treat urgency as a warning sign. Real bosses and real banks can survive a ten-minute delay.
• Never change account details from a message alone. Confirm in writing through a separate route.

(Yes, it feels rude to double check the CEO. Do it anyway. A real CEO will be glad you did.)

So here's the uncomfortable question to leave with. If a scammer needed only a few seconds of someone's voice and one believable message to move $108 million, what is the one person in your life whose name on your screen would make you stop thinking?

Deepfake Video Detection: Frequently Asked Questions